Need help recovering data from Truecrypt disk that won't boot

Discussion in 'encryption problems' started by flcubuff, Oct 12, 2013.

Thread Status:
Not open for further replies.
  1. flcubuff

    flcubuff Registered Member

    Oct 12, 2013
    Hello and thanks for this informative forum.

    I am hoping to recover important files from a disk encrypted with Truecrypt that won't boot.

    First - I now fully realize the importance of regular backups - won't happen again.

    Second - I do not have the crucial info related to the system behavior when the failure occurred. It's my son's college laptop and that info is lost to the massive neuronal assault of all else college has to offer.

    We used the full disk encryption option when encrypting the disk which is a 320GB Toshiba SATA drive.

    After entering the password during Pre-boot Authentication the message "Booting!..." briefly appears. After that, nothing. The system goes in the weeds never to be heard from again.

    Here is what I have tried:

    Restored the TrueCrypt boot loader from the TrueCrypt Rescue Disk Available Repair Options menu. Did not change system behavior.

    Tried TC Rescue Disk Skip Authentication option. This produces the error message "No bootable partition found".

    Loaded TrueCrypt onto my XP desktop. Removed the problem hard drive from its laptop and connected it to a desktop USB port using an SATA to USB adapter cable.

    TrueCrypt sees the hard drive which has 4 partitions. I am able to use TrueCrypt to successfully mount all 4 partitions with the options "Read Only" and "Do not use pre-boot authentication" enabled.

    Windows explorer is then able to see data on 3 of the partitions with no problem. Unfortunately, the data I need is on the last partition which Windows Explorer sees as "RAW".

    After reading suggestions from other posts re: TrueCrypt problems on this site (thank you dantz!) I attempted to recover files from the "RAW" partition with what I understand to be a relatively benign recovery tool: Photorec

    Photorec was able to recover many jpg files, a couple of pdfs, and numerous (thousands) of files with the extensions .txt and .xml among others, all of which appear to be incomplete snippets of larger files. None of this is the useable data which would have been in the My Documents directory, however.

    So the drive appears to be basically functional with coherent data even on the partition that appears as "RAW".

    I am looking for any help on how to proceed (cautiously) with next steps.

    Thanks in advance.
Thread Status:
Not open for further replies.